Executive brief
The SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows unauthorized access to its database. An attacker can exploit this to view sensitive information, modify records, or disrupt the scheduling system's operations. This vulnerability can be exploited remotely without needing a username or password.
Technical details
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/archive3.php' component. The root cause is the improper neutralization of the 'sy' POST parameter, which is used directly in SQL queries without sufficient validation or sanitization. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to perform boolean-based blind or error-based SQL injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential manipulation of system records. A public exploit (PoC) has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-05-20: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-08: advisory: NVD/VulDB advisory published